CVE-2021-24308

The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. Thi...

CVE-2021-24181

The tutormarkanswerascorrect AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students...

VulnCheck KEV: CVE-2021-24186

The tutoransweringquizquestion/getanswerbyid function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

VulnCheck KEV: CVE-2021-24182

The tutorquizbuildergetanswersbyquestion AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

CVE-2020-27481

An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin = 2.1.4 exists due to the usage of "wpajaxnopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlrlmscancelbooking" where POST Parameter "id" was sent straight into SQL query witho...

CVE-2020-27481

The Good Layers LMS Plugin (version 2.1.4 and earlier ) for WordPress is vulnerable to an unauthenticated SQL Injection . The flaw occurs because the plugin uses the wp_ajax_nopriv call to expose the gdlr_lms_cancel_booking function, which processes the id POST parameter directly in a SQL query w...

CVE-2020-27481: Improper Neutralization of Special Elements used in an SQL Command

An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin = 2.1.4 exists due to the usage of "wpajaxnopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlrlmscancelbooking" where POST Parameter "id" was sent straight into SQL query witho...

PT-2020-16690

Name of the Vulnerable Software and Affected Versions Good Layers LMS Plugin versions 2.1.4 and earlier Description The issue is related to an unauthenticated SQL Injection vulnerability. It exists due to the usage of "wp ajax nopriv" call in WordPress, allowing any unauthenticated user to access...

VulnCheck KEV: CVE-2020-27481

An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin = 2.1.4 exists due to the usage of "wpajaxnopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlrlmscancelbooking" where POST Parameter "id" was sent straight into SQL query witho...

WordPress Tutor LMS Plugin Cross Site Request Forgery (CVE-2020-8615)

A cross site request forgery vulnerability exists in WordPress Tutor LMS Plugin. Successful exploitation of this vulnerability can result in the execution of arbitrary code in the effected system...

CVE-2020-8615

CVE-2020-8615 is a CSRF vulnerability in the WordPress Tutor LMS plugin up to version 1.5.3 (fixed in 1.5.3). The issue allows an attacker to approve themselves as an instructor and perform other actions (e.g., blocking legitimate instructors). The root cause is CSRF in Tutor LMS’s instructor-man...

CVE-2020-7108: Improper Neutralization of Input During Web Page Generation

The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field...

WordPress Learning Management System Plugin - course_id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Good LMS - Learning Management System WP Plugin SQL Injection Exploit Author Web Site: http://esecurity.ir Special Thanks : Meisam Monsef email protected - Telegram ID : @meisamrce Vendor Homepage: https://goodlayers.com/ Versio...